Safety

StockPacks ships before an independent external audit. The safety design is built around that fact rather than around a claim that it is unnecessary.

Audit status

The contracts have had thorough internal review: a full internal audit, a conformance audit against the FWA design they fork, and adversarial review passes — with findings reproduced as failing tests before being fixed, and the economics regression-tested down to exact-to-the-wei solvency across every settlement branch. They have not completed an independent external audit. Those are different things and we are not going to blur them.

The line we hold

The owner can stop the protocol taking new business, and can always let you leave. At no point can the owner take your stock or your backing.

Withdrawals always work. Pausing blocks new deposits and new draws. It never blocks a depositor leaving with their stock and their backing.
Escape mode is a one-way switch to unconditional withdrawals. It cannot be undone, and it permanently stops new business.
Payouts are pull, not push. Everything owed is credited and claimed, so one address with a reverting fallback cannot block settlement for anyone else.
Stock delivery is defensive. If a stock transfer fails, your ETH still goes out and the stock becomes claimable later via claimStranded. A frozen token can never trap the rest of your position.
Solvency by construction. Backing is escrowed per listing and never spent on another depositor's payout.

Third-party risk you cannot avoid here

The stock tokens in this pool are upgradeable contracts controlled by their issuer, who retains pause, blocklist and administrative burn powers over them. That is outside our control and outside yours. It is also the main reason StockPacks is not immutable the way FWA is: a contract that cannot react to an asset that can be frozen underneath it is not safer.

Prices come from third-party oracles. Oracle failure, staleness or manipulation would affect backing amounts, pack pricing and selection weights.

The open trust assumption

The owner can currently repoint the randomness coordinator. A malicious coordinator could return a chosen word, which would let whoever controls it pick the drawn listing and buy that pack. This is the one path by which the owner could extract value, and it is real until ownership moves to the multisig.

Ownership transfers to a 2-of-3 multisig shortly after launch. Both the core contract and the randomness coordinator have to move for the mitigation to be complete. Until then, this is a trust assumption you are making, and it is stated here rather than left for someone to discover.

If something goes wrong

refundExpired — permissionless. If randomness never arrives, anyone can trigger your refund.
processAcquisitions and activateStaged — permissionless. A keeper outage delays settlement; it never risks funds.
claim and withdraw — always available, including while paused and in escape mode.